CVE-2021-22116: debian debian_linux Uncontrolled Resource Consumption
Vulnerability summary
CVE-2021-22116 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in debian debian_linux. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 72.3% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 04-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 6Timeline
- 08-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.39%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.39% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- rabbitmq-server< 3.9.4-1
- debian_linuxEOL9.0
Ubuntu1 product
- rabbitmq-server< 3.5.7-1ubuntu0.16.04.4+esm1 | < 3.6.10-1ubuntu0.5 | < 3.8.2-0ubuntu1.3 | < 3.8.9-3ubuntu1
Vmware1 product
- rabbitmq< 3.8.16
3 vendors · 4 products
References
7 links
lists.debian.org/debian-lts-announce/2021/07/msg00011.htmlMailing ListX Refsource MLISTThird Party Advisory